CVE-2026-89208 PUBLISHED

Assigner: siemens
Reserved: 11.09.2026 Published: 13.10.2026 Updated: 13.10.2026

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Siemens
Product	Capital Embedded AR Classic 431-422
Versions	Default: unknown affected from 0 to * (excl.)

Vendor	Siemens
Product	Capital Embedded AR Classic R20-11
Versions	Default: unknown affected from 0 to V2303 (excl.)

Vendor	Siemens
Product	Desigo PXC00-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC00-U
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC001-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC100-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC12-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC128-U
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC200-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC22-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC22.1-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC36.1-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC50-E.D
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXC64-U
Versions	Default: unknown affected from V2.3 to * (excl.)

Vendor	Siemens
Product	Desigo PXM20-E
Versions	Default: unknown affected from V2.3 to * (excl.)

References

Problem Types

CWE-125: Out-of-bounds Read CWE